Spideroak Kloak: Zero-Knowlege Social Networking • Hacker News Board

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#61

Post by daviddahl » Sat, Dec 12, 2015, 7:15 PM UTC

adrtessier wrote: post #30

Taek wrote: post #22

Earlier quoted context omitted.

How does Kloak handle metadata? If people can see who you communicate with, they can get access to your social network, which contains a lot of information. By seeing my location dozens of times, a company can figure out where I live. They might not know what bar I went to last night but they will be able to know that I visit Chipotele frequently. It's better than nothing, but it seems like strong analytics could sti…

I was about to ask a lot of these questions of how deep the metadata layer really goes - including using SpiderOak as the threat. It seems this is built on Crypton, linked below; however, the paper itself [1] goes into a lot of detail on what metadata SpiderOak could see, and what they can infer from it. I am personally curious why p384/ECDSA was chosen; vs. p521 or Curve25519+Ed25519. I assume this is because p384 i…

p384 is the standard, yes, however, any future implementation of Crypton will, I hope, move to Curve25518

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#62

Post by daviddahl » Sat, Dec 12, 2015, 7:18 PM UTC

politician wrote: post #48

I don't see how you can trust any of these sorts of privacy apps without compiling and side-loading them yourself. Even then, it's risky on a device you really don't control (f.e. Are we sure that the wi-fi radio that the FCC requires manufacturers to isolate from apps can't itself backdoor the device? Will we always be sure that the app developer won't ever update the software in a nefarious way?)

This is easy to do in this case, as the source is on github: https://github.com/Crypton/statusapp. Also, you can run your own server if you like.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#63

Post by daviddahl » Sat, Dec 12, 2015, 7:20 PM UTC

kijin wrote: post #52

Just tried the Android app. The automatically generated xkcd-style passphrase is really cool, but the app insists on storing it in the operating system's credential storage with seemingly no other option. As it happens, I don't have credential storage enabled on the spare device I tested it on, so this was a bit annoying. I've dabbled with several messaging apps from Signal to Telegram and a bunch of others in betwee…

Yeah, Android < 5 is a PITA as there is no secure storage. I almost wish I could make this app require Android 5.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#64

Post by darkmighty » Sat, Dec 12, 2015, 9:49 PM UTC

daviddahl wrote: post #43

darkmighty wrote: post #29

Earlier quoted context omitted.

How are you doing fuzzy locations? You're probably not doing it this way, but note that just adding a random 4 mile radius vector to the users location in insecure (against multiple samplings), you need to quantize it to a fixed set like a 4 mile grid or something like that. I remember tinder made this mistake and you could locate users very precisely anonymously.

The dataset of all towns in the world with > 1000 inhabitants is bundled into Kloak. The GPS location was originally highly accurate, but we rounded down to 2 decimal places. So if your GPS coordinates match the center of the city (rounded down), a place name can be generated. It basically will place you near the center of the closest town, again, its naively rounded to 2 decimal places. I want to go back to make thi…

Yea just rounding the coordinates is problematic at high latitudes. Curiously, the problem of finding a "nice" quantization set on the sphere is a well known mathematical problem called Spherical Coding [1]. But you don't need anything this fancy I guess, you can just round the coordinates if the latitude is less than e.g. 60 degrees , and if above you chose another pole and round the coordinates with respect to the second pole. It would probably be a good idea to add some hysteresis as suggested below too (so you're not localizable when you're at one of the edges). Then you can give it some fancy name like "Advanced location privacy protection" :)

http://mathworld.wolfram.com/SphericalCode.html

https://en.wikipedia.org/wiki/Tammes_problem

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#65

Post by kseistrup » Sat, Dec 12, 2015, 10:15 PM UTC

mstade wrote: post #56

I've been wanting something like this for a long time: a private network for those you trust and truly care about, offering actual privacy but without requiring my less-than-technically-inclined friends and family an easy way to opt in. I have hundreds of "friends" on Facebook, many I don't really know but think of as potentially useful contacts to have. It's like a more casual LinkedIn to me, you could say. Funny no…

— and in danish ⌘ https://twitter.com/kseistrup/status/675775244565655556

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#66

Post by newscracker » Sun, Dec 13, 2015, 6:26 AM UTC

@daviddahl, is there any reason why this is not available from a browser and instead seems to be available only through Android and iOS apps? If it's not available from a browser, is there a plan to introduce that (when)? It looks like desktops, laptops and other mobile platforms that have standard compliant browsers are completely ignored.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#67

Post by dumaspere » Sun, Dec 13, 2015, 3:42 PM UTC

How would I keep up with developments from Spideroak? Their blog (https://spideroak.com/about/perspectives ?) does not appear to have an RSS feed.

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#68

Post by ytjohn » Sun, Dec 13, 2015, 5:07 PM UTC

daviddahl wrote: post #58

ytjohn wrote: post #55

I tested this out. I don't know anyone else to try with, so here is my contact card: https://goo.gl/photos/yhVvYGfy9Vepcp1h9 I found one other person on G+ and imported their card. I saw it said "adding to trusted contacts". I assume it means that they can read anything I post. I went to timeline and saw nothing new from the other contact. I expect that because I'm not one of their trusted contacts, I can't see what…

My contact card is here: https://twitter.com/deezthugs/status/654457605650255872 I'll add you to my contacts now

I added you as well. I am deltafoxzed on Kloak

Re: Spideroak Kloak: Zero-Knowlege Social Networking

#69

Post by [deleted] » Mon, Dec 14, 2015, 6:51 PM UTC

daviddahl wrote: post #46

falien wrote: post #39

Earlier quoted context omitted.

This seems buried. Is there a reason it's not mentioned or linked on the kloak page? I actually went looking for the code and couldn't find that repository.

The link to the source code is in the about screen in the app. Hardly buried. I will have it added to the site, I was unaware of this.

[deleted]